Stars Arena

Summary

Stars Arena was Avalanche's answer to friend.tech: a SocialFi app, launched September 27, 2023 by a pseudonymous developer known as "theBuilder," in which each user's social presence was tokenized as bonding-curve "Tickets" that granted holders gated access (DMs, private posts) and a cut of trading fees. Riding the late-2023 SocialFi wave, it became one of Avalanche's most active dApps within days — roughly $2.78M peak TVL, 18,000 active wallets, and a reported high of ~250K daily transactions. On October 5, 2023 a small exploit (2,014 AVAX) was patched and dismissed by the team as "coordinated FUD"; two days later, on October 7, a reentrancy attack drained 266,104 AVAX ($2.97M) — essentially the entire contract balance, leaving $0.051. After on-chain negotiation, the attacker returned 90% for a 10% bounty. The original team fractured amid resignations; in November 2023 a new team acquired the project and rebranded it as The Arena (arena.social), which later raised a $2M pre-seed (October 2024), launched the ARENA token (TGE October 29, 2024), and shipped a V2 in 2025. The Stars Arena experiment itself is best classified as exploited; its acquired successor is a separate, ongoing story.

Design (Mechanism)

Stars Arena forked friend.tech's core primitive onto Avalanche's C-Chain:

• Bonding-curve shares ("Tickets"): every account had its own share supply priced on a quadratic-style bonding curve, starting around 0.0066 AVAX. Buying pushed the price up deterministically; selling returned AVAX from the contract's pooled reserves. The single shares contract (an upgradeable proxy) held all users' AVAX.
• Fee splitting: each trade charged a fee split between the platform and the "subject" (the person whose tickets were traded), giving creators direct monetization and holders exposure to a creator's rising demand.
• Token-gated social features: holding someone's ticket unlocked their private feed/DMs — the social utility layer meant to justify the asset beyond pure speculation.
• Referral rewards: referrers earned 1% of trades made by users they onboarded, a growth loop layered on top of the curve.
• Differentiators vs friend.tech: a fuller Twitter-like public feed (posts, threads) rather than chat-only, and Avalanche's low fees/fast finality for high-frequency micro-trades.

Critically, the shares contract was custom-written and (per post-mortems) deployed without an audit and without standard reentrancy guards or checks-effects-interactions ordering.

Outcome

• Growth phase (Sept 27 – Oct 5, 2023): explosive adoption; ~$1M+ TVL within a week, peak ~$2.78M; cumulative volume near $5M; became a flagship of Avalanche's consumer-app push.
• Oct 5, 2023: first exploit drains ~2,014 AVAX; patched; team publicly downplays risk.
• Oct 7, 2023: attacker (0xa2Ebf3FCD757e9BE1E58B643b6B5077D11b4ad7A) exploits reentrancy in the share-purchase flow (attack tx 0x4f37ffecdad598f53b8d5a2d9df98e3c00fbda4328585eb9947a412b5fe17ac5): re-entering during a buy let them manipulate the "weight" used in price calculation, inflating one share's sell price to ~274,000 AVAX and draining ~$2.97M — the contract was left with $0.051.
• Recovery: the team negotiated on-chain; 90% of funds returned for a 10% bounty (Oct 11–12, 2023). The app relaunched with trading paused, but momentum was gone and team members resigned publicly.
• Aftermath: acquired in November 2023 by a new team (CEO Jason Desimone, COO Phillip Liu Jr.), rebranded The Arena; $2M pre-seed announced October 2024 with participation from Avalanche ecosystem funds and angels including Balaji Srinivasan; ARENA token launched October 29, 2024; V2 (launchpad + native DEX) in 2025 revived it as one of Avalanche's most-used consumer dApps.

Why it worked

• Proven mechanism, fresh distribution: friend.tech had already validated the keys/tickets primitive; porting it to Avalanche captured an underserved ecosystem hungry for a consumer hit, with ecosystem influencers amplifying it.
• Cheap, fast chain fit the mechanic: bonding-curve micro-trades are fee-sensitive; Avalanche's low costs enabled the high-frequency speculation the model thrives on.
• Aligned incentives at the surface level: creators earned fees, holders got upside plus gated access, referrers earned a trade cut — a tight speculative-social flywheel that produced genuinely viral growth in days.

Where the design broke

• No audit gate before holding funds: an unaudited custom contract holding all user funds contained a textbook reentrancy bug — the class of vulnerability known since The DAO (2016) and preventable with a standard guard or checks-effects-interactions.
• No circuit breaker after a partial drain: the Oct 5 exploit reduced the contract's balance, but trading continued without a pause, audit, or funds-segmentation being triggered. Two days later the same contract was drained in full.
• Single-contract honeypot design: pooling every user's AVAX in one upgradeable proxy meant one bug equaled total loss.
• Speculation-first fundamentals: as with friend.tech, most "social" value was a wrapper around curve speculation, leaving no durable non-speculative utility once trust in the contract broke.

Lessons

• Reentrancy is a solved problem; skipping the solution is a choice. Any contract that sends native tokens during state transitions needs reentrancy guards and checks-effects-interactions — and an audit before holding millions.
• A small exploit is a fire alarm, not FUD. The Oct 5 incident was a free warning; the correct response to any successful drain, however small, is pause-and-audit, not public reassurance.
• Forking code is not forking security posture. Cloning friend.tech's mechanism without its (battle-tested) implementation details recreated the product but not its safety; forks under time-to-market pressure are systematically more exploit-prone than originals.
• Pooled-reserve bonding curves concentrate risk. The same design that makes tickets instantly liquid makes the protocol a single honeypot; isolating reserves or capping per-contract exposure limits blast radius.
• Bounty-for-return negotiation works often enough to institutionalize. The 90/10 settlement recovered most user funds; teams should pre-commit to whitehat bounty terms before an incident.
• Brands can be rebuilt, but usually only by new owners. The mechanism survived via acquisition and rebrand (The Arena), suggesting exploit-killed projects retain salvageable community value under credibly new stewardship.

Redesign (EDITORIAL — hypothesis, not fact)

The following is editorial analysis — a hypothesis about an alternative design, not a factual account.

A redesigned Stars Arena would keep the ticket flywheel but re-architect custody and rollout. First, security basics: audited contracts built on battle-tested libraries (OpenZeppelin ReentrancyGuard), an invariant check asserting reserve balance ≥ sum of curve obligations after every trade, and a circuit breaker that auto-pauses trading when outflows in a rolling window exceed a threshold — which would have capped the Oct 7 drain at a fraction of TVL. Second, blast-radius isolation: per-creator vault contracts (minimal proxies) rather than one global pool, so a bug in one curve cannot drain all users. Third, a staged TVL ramp: hard caps on total contract holdings during the first weeks, raised only after audits and a public bug bounty season — trading virality for survivability. Finally, on the mechanism itself, shift value accrual from pure curve speculation toward fee-earning: route a larger share of trade fees into holder rewards and creator revenue-splits, making tickets closer to cash-flowing assets and dampening the reflexive pump-dump dynamic that made both friend.tech and Stars Arena fragile. The Arena's later evolution (token, launchpad, DEX integration) partially validates this direction, though its long-term durability remains an open question.